3 ms·
although we discovered this buffer overflow manually, we later tried to fuzz the vulnerable function, parse_tunables(); both AFL++ and libFuzzer re-discovered t
by tremon 3y ago
although we discovered this buffer overflow manually, we later tried to fuzz the vulnerable function, parse_tunables(); both AFL++ and libFuzzer re-discovered this overflow in less than a second, when provided with a dictionary of tunables
How prevalent is the use of fuzzers in FLOSS infrastructure projects? I know the Linux kernel is regularly fuzzed, but even there I'm not sure if this is done by regular kernel developers/maintainers or third-party researchers.
- pengaru 3y agoSystemd at least gets fuzzed continuously... https://github.com/systemd/systemd/tree/main/test/fuzz https://github.com/systemd/systemd/tree/main/test/fuzz https://github.com/systemd/systemd/actions https://github.com/systemd/systemd/actions But it's not like you just point a fuzzer at a project and voila magic it's all getting fuzzed... The "yes we fuzz" checkbox can be checked while still having substantial gaps in the coverage.
- throwawaaarrgh 3y agoMost FOSS software has minimal testing. Fuzzers are only used by companies with their own security teams doing due diligence on their stacks.